CVE-2022-42252

🗓️ 01 Nov 2022 00:00:00Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 620 Views

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false, Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was behind a reverse proxy that also failed to reject the request

Reporter	Title	Published	Views	Family All 205
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server	31 Oct 202315:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management	22 Mar 202416:05	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat is vulnerable to HTTP request smuggling (CVE-2022-42252)	19 Dec 202219:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-42252	20 Dec 202207:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	26 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerability in Apache Tomcat	7 Nov 202407:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-42252	20 Jan 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9	8 Dec 202204:10	–	ibm

NVD

Vulners

Node

apache tomcatRange8.5.0–8.5.83

apache tomcatRange9.0.0–9.0.68

apache tomcatRange10.0.0–10.0.27

apache tomcatRange10.1.0–10.1.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Tomcat",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "10.1.0",
        "status": "affected",
        "version": "10.1.0-M1",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "10.0.26",
        "status": "affected",
        "version": "10.0.0-M1",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "9.0.67",
        "status": "affected",
        "version": "9.0.0-M1",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "8.5.82",
        "status": "affected",
        "version": "8.5.0",
        "versionType": "maven"
      }
    ]
  }
]